The existence of adversarial examples brings huge concern for people to apply Deep Neural Networks (DNNs) in safety-critical tasks. However, how to generate adversarial examples with categorical data is an important problem but lack of extensive exploration. Previously established methods leverage greedy search method, which can be very time-consuming to conduct successful attack. This also limits the development of adversarial training and potential defenses for categorical data. To tackle this problem, we propose Probabilistic Categorical Adversarial Attack (PCAA), which transfers the discrete optimization problem to a continuous problem that can be solved efficiently by Projected Gradient Descent. In our paper, we theoretically analyze its optimality and time complexity to demonstrate its significant advantage over current greedy based attacks. Moreover, based on our attack, we propose an efficient adversarial training framework. Through a comprehensive empirical study, we justify the effectiveness of our proposed attack and defense algorithms.

翻译：对抗性实例的存在使人们非常关注在安全关键任务中应用深神经网络(DNN)的问题。然而,如何生成带有绝对数据的对抗性实例是一个重要问题,但缺乏广泛的探索。以前采用的方法利用贪婪的搜索方法,而这种方法可能非常耗时,以便成功地进行攻击。这也限制了对绝对数据进行对抗性培训和潜在防御的开发。为了解决这一问题,我们提议了概率性分类反对立攻击(PCAAA),它将离散的优化问题转移到一个能够通过预测“梯子”有效解决的持续问题上。我们从理论上分析其最佳性和时间复杂性,以表明其对当前基于贪婪的攻击的巨大优势。此外,根据我们的攻击,我们提出了一个高效的对抗性培训框架。通过全面的经验研究,我们证明我们提出的攻击和防御算法的有效性。